---
schema: 1
kind: vulnerability
title: "CVE-2026-84869 — ConnectWise ScreenConnect: a missing file-transfer authorization check lets an active remote session push and auto-run files on the Host, and Huntress traced worm-like exploitation back to 20 August, weeks before any patch existed (CVSS 9.9)"
headline: "ConnectWise patches a ScreenConnect flaw Huntress had already watched turn every infected connection into the next one's launch point"
summary: >
  CVE-2026-84869 (CVSS 9.9) lets file-transfer actions inside an already-active ConnectWise
  ScreenConnect remote session run without the authorization or Host-confirmation step the product
  is meant to require. Huntress documented exploitation from 20 August 2026, over two weeks before
  ConnectWise's 8 September patch (26.6.5), in which a modified ScreenConnect client automatically
  pushes the same infection chain to every newly connected Host session, giving the bug a worm-like
  spread across an MSP's or IT department's own remote-support connections.
discovered_at: "2026-09-12T04:09:19Z"
updated_at: null
event_date: "2026-09-08"
run_id: 2026-09-12T0409Z-intel
priority: high
immediate_action: null
tags: [vulnerabilities, actively-exploited, rce, auth-bypass, cisa-kev, patch-available]
regions: [global]
sectors: [public-sector, technology]
entities: []
techniques: [T1219, T1570, T1105, T1548.002, T1685, T1211, T1496, T1090, T1543.003]
affected_products: ["ConnectWise ScreenConnect"]
cves:
  - id: CVE-2026-84869
    cvss: "9.9"
    epss: "0.0038"
    type: auth-bypass
    vector: zero-click
    auth: post-auth
    status: [exploited, cisa-kev, patch-available]
    affected: "ScreenConnect client versions prior to 26.6.5"
    fixed: "26.6.5"
sources:
  - url: "https://github.com/ConnectWise-Advisories/Disclosures/tree/main/CVE-2026-84869"
    publisher: "ConnectWise (vendor disclosure)"
    date: "2026-09-08"
    role: primary
  - url: "https://www.huntress.com/blog/rogue-screenconnect-installations"
    publisher: "Huntress"
    date: "2026-09-03"
    role: primary
  - url: "https://www.securityweek.com/modified-screenconnect-clients-used-in-worm-like-campaign/"
    publisher: "SecurityWeek"
    date: "2026-09-07"
    role: corroborating
  - url: "https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json"
    publisher: "CISA KEV catalog (catalogue version 2026.09.11)"
    date: "2026-09-11"
    role: corroborating
closed_sources: []
evidence:
  - quote: "A condition in the ScreenConnect client may allow files to be transferred and executed through an active remote session without authorization or Host confirmation in certain circumstances. ScreenConnect servers are not impacted."
    publisher: "ConnectWise (vendor disclosure)"
  - quote: "This creates a worm-like behavior: propagating infections over new ScreenConnect connections. Connecting to an infected ScreenConnect client can cause the server-side Host system to receive and execute the same four-stage VBScript chain."
    publisher: "Huntress"
  - quote: "In late August, our Security Operations Center (SOC) sent out three critical incident reports for what looked like malicious ScreenConnect installation and unexpected process execution."
    publisher: "Huntress"
verification: multi-source
sourcing_note: null
confidence: high
references: []
deep_dive: false
deep_dive_category: null
org_triage: null
classification:
  reliability: A
  credibility: 1
watchlist_hit: false
actions:
  - "Upgrade every ConnectWise ScreenConnect on-premise client to 26.6.5 now; where an immediate upgrade is blocked by a change window, remove the TransferFiles role permission from every session group in the interim (Administration > Security > Roles) — ScreenConnect servers themselves are not affected, only clients."
  - "Treat any pre-26.6.5 ScreenConnect client that shows a second, unfamiliar RMM tool (UltraViewer, Quick Assist) or an unexplained ScreenConnect connection ID as compromised, not merely vulnerable: reimage rather than patch in place — the worm mechanism means a technician's own session can already have propagated the infection to every host that client actively connected to."
updates: []
migrated_from: null
---

ConnectWise's own disclosure describes a client-side condition in ScreenConnect Support and Access sessions where file-transfer actions could be processed through an active remote session "without proper authorization or Host confirmation," letting files be transferred to and executed on the Host system, including through elevated execution paths ([ConnectWise, 2026-09-08](https://github.com/ConnectWise-Advisories/Disclosures/tree/main/CVE-2026-84869)). ScreenConnect servers are not affected — only client versions before 26.6.5, the release that fixes CVE-2026-84869 (CWE-862 Missing Authorization, CWE-269 Improper Privilege Management, CVSS 9.9).

Huntress had been tracking the exploitation for two and a half weeks before any advisory existed. Starting 20 August 2026, its SOC found rogue ScreenConnect clients deployed via social engineering — a fake tech-support Quick Assist session in one case, a phishing-driven MSI in another — that immediately spawned four chained VBScript stagers via `wscript.exe`. The stagers profile the host (existing ScreenConnect install, installed security-product names, available RAM to rule out a sandbox), then pull an AES-encrypted payload bundle keyed to that profile from Dropbox. Depending on the profile, the final PowerShell stage installs a ScreenConnect backdoor client concealed as a hidden Windows service — its registry Uninstall entry removed and a restrictive service security descriptor applied — builds a UAC-bypass helper via a hijacked `ms-settings:` protocol handler routed through `ComputerDefaults.exe`, sets `AmsiUtils.amsiInitFailed = true` to blind AMSI, adds all of `C:\Users` as a Defender exclusion, and disables Defender reporting, notifications and Hypervisor-Protected Code Integrity — the last of these via a vulnerable WinRing0 kernel driver dropped alongside the payload ([Huntress, 2026-09-03](https://www.huntress.com/blog/rogue-screenconnect-installations)). The broadest observed variant then drops a `wstunnel` tunneling tool disguised as `Themes.exe` and an XMRig cryptominer disguised as `SearchIndex.exe`.

The installed backdoor client is what turns the bug into a worm: it continuously inspects ScreenConnect's own connection-status collection for newly established Host sessions and, on each new connection, packages the same four VBScript stagers into a ScreenConnect file-transfer message flagged to auto-run — the exact abuse path CVE-2026-84869 patches. A technician's ScreenConnect client that has been infected this way silently re-infects every subsequent host it connects to, independent of the original social-engineering vector ([Huntress, 2026-09-03](https://www.huntress.com/blog/rogue-screenconnect-installations)). No named threat-actor cluster is attributed by any source; CISA added the CVE to its Known Exploited Vulnerabilities catalog on 2026-09-11 with a three-day remediation deadline ([CISA KEV, catalogue version 2026.09.11](https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json)).

**Defender takeaway:** any MSP-managed or self-hosted ScreenConnect deployment — including the IT-service-provider chain that reaches public-sector customers — should patch to 26.6.5 immediately and treat every pre-patch client as a potential re-infection vector, not just the host that was originally targeted. **Triage:** a benign ScreenConnect file-transfer message is initiated by a human technician against a session they are actively working; the worm's signature is a file-transfer action auto-queued the moment a new Host connection appears, with no corresponding operator action, immediately followed by `wscript.exe` spawning multiple child `.vbs` processes.